[
https://issues.apache.org/jira/browse/HADOOP-19912?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jose Luis López updated HADOOP-19912:
-------------------------------------
Description:
Move Hadoop's web servers off Jetty 9.4, which is end of life: its releases are
now rare and sponsored, and its CVEs keep coming (HADOOP-19910, HADOOP-19915).
h3. Approach
Jetty 12 serves two servlet APIs side by side: the ee8 environment serves
{{javax.servlet}}, while ee10 and ee11 serve {{jakarta.servlet}}. This issue
moves Hadoop to Jetty 12 on ee8, so the servlet namespace, Jersey 2 and every
public signature stay as they are.
The move to the jakarta namespace (Jetty ee10, Jersey 3, JAXB 4) is a separate
decision, tracked in HADOOP-19395, which starts from here.
Jetty 12 needs Java 17, so this is for trunk. Release lines that stay on Jetty
9.4 are covered by HADOOP-19915.
h3. Sub-tasks
||Issue||Scope||State||
|HADOOP-19970|Resolve one Jetty release and one servlet API on every module
classpath. No version change.|Patch available (PR #8699)|
|HADOOP-19972|Jetty 9.4.58 → 12.1.12 on ee8: {{HttpServer2}}, KMS, HttpFS, the
YARN web apps, WebSocket, SLS, the services API, shaded clients,
LICENSE-binary. Keeps trunk's behaviour wherever Jetty 12 allows, and lists the
rest for the release note.|Patch available (PR #8704)|
|HADOOP-19951|Drop jetty-util-ajax in favour of Jackson.|Fixed (3.6.0)|
|HADOOP-xxxxx|Retire or upgrade the YARN application catalog. It stays on Jetty
9.4.58 because Solr 8 needs it, and it is the last Jetty 9.4 in the build.|Open|
|HADOOP-xxxxx|Remove the JAX-RS 1.1 API ({{jsr311-api}}) from
{{hadoop-yarn-server-timelineservice-hbase-tests}}, where it duplicates JAX-RS
2.1 on the classpath. Same kind of cleanup as HADOOP-19970.|Open|
Related: HADOOP-19971 removes servlet and Jetty types from classes that do not
need them, which reduces Hadoop's coupling to Jetty. It is a sub-task of
HADOOP-19395.
h3. Behaviour changes
HADOOP-19972 is marked Incompatible. Its release note covers what Jetty 12
changes for callers:
* no custom HTTP reason phrase; refusal messages travel in the response body
instead, and Hadoop's clients read them there;
* stricter URI parsing, adjustable with
{{hadoop.http.uri.compliance.violations}};
* TLS 1.2 renegotiation off by default, adjustable with
{{hadoop.http.ssl.renegotiation.allowed}};
* the five async HTTP metrics read 0, because Jetty 12 cannot count them;
* Jetty's own output: error-page markup, {{charset=utf-8}} and {{Vary}} on
static files, a {{Date}} header on error responses, and the default acceptor
count.
h3. Done when
* No Jetty 9.4 artifact is left on any module classpath of the trunk build.
* Every daemon serves on Jetty 12, and the full test suite passes.
* The release note of HADOOP-19972 lists every incompatible change.
h3. Out of scope
* The jakarta namespace, Jetty ee10/ee11, Jersey 3 and JAXB 4: HADOOP-19395.
* Jetty 9.4 security updates on release lines that cannot move to Java 17:
HADOOP-19915.
was:
See HADOOP-19910 - there is a CVE in Jetty but releases of 9.4 are rare and are
'sponsored' - Jetty 9.4 is not actively maintained. There are some commercial
forks.
Jetty 12 needs Java 17+.
Will also force Jersey to upgraded to 3 or 4.
And to replace many javax classes/jars with their jakarta equivalents.
> Upgrade to Jetty 12 on the ee8 environment keeping javax.servlet
> ----------------------------------------------------------------
>
> Key: HADOOP-19912
> URL: https://issues.apache.org/jira/browse/HADOOP-19912
> Project: Hadoop Common
> Issue Type: Task
> Reporter: PJ Fanning
> Assignee: Jose Luis López
> Priority: Major
> Labels: pull-request-available
>
> Move Hadoop's web servers off Jetty 9.4, which is end of life: its releases
> are now rare and sponsored, and its CVEs keep coming (HADOOP-19910,
> HADOOP-19915).
> h3. Approach
> Jetty 12 serves two servlet APIs side by side: the ee8 environment serves
> {{javax.servlet}}, while ee10 and ee11 serve {{jakarta.servlet}}. This issue
> moves Hadoop to Jetty 12 on ee8, so the servlet namespace, Jersey 2 and every
> public signature stay as they are.
> The move to the jakarta namespace (Jetty ee10, Jersey 3, JAXB 4) is a
> separate decision, tracked in HADOOP-19395, which starts from here.
> Jetty 12 needs Java 17, so this is for trunk. Release lines that stay on
> Jetty 9.4 are covered by HADOOP-19915.
> h3. Sub-tasks
> ||Issue||Scope||State||
> |HADOOP-19970|Resolve one Jetty release and one servlet API on every module
> classpath. No version change.|Patch available (PR #8699)|
> |HADOOP-19972|Jetty 9.4.58 → 12.1.12 on ee8: {{HttpServer2}}, KMS, HttpFS,
> the YARN web apps, WebSocket, SLS, the services API, shaded clients,
> LICENSE-binary. Keeps trunk's behaviour wherever Jetty 12 allows, and lists
> the rest for the release note.|Patch available (PR #8704)|
> |HADOOP-19951|Drop jetty-util-ajax in favour of Jackson.|Fixed (3.6.0)|
> |HADOOP-xxxxx|Retire or upgrade the YARN application catalog. It stays on
> Jetty 9.4.58 because Solr 8 needs it, and it is the last Jetty 9.4 in the
> build.|Open|
> |HADOOP-xxxxx|Remove the JAX-RS 1.1 API ({{jsr311-api}}) from
> {{hadoop-yarn-server-timelineservice-hbase-tests}}, where it duplicates
> JAX-RS 2.1 on the classpath. Same kind of cleanup as HADOOP-19970.|Open|
> Related: HADOOP-19971 removes servlet and Jetty types from classes that do
> not need them, which reduces Hadoop's coupling to Jetty. It is a sub-task of
> HADOOP-19395.
> h3. Behaviour changes
> HADOOP-19972 is marked Incompatible. Its release note covers what Jetty 12
> changes for callers:
> * no custom HTTP reason phrase; refusal messages travel in the response body
> instead, and Hadoop's clients read them there;
> * stricter URI parsing, adjustable with
> {{hadoop.http.uri.compliance.violations}};
> * TLS 1.2 renegotiation off by default, adjustable with
> {{hadoop.http.ssl.renegotiation.allowed}};
> * the five async HTTP metrics read 0, because Jetty 12 cannot count them;
> * Jetty's own output: error-page markup, {{charset=utf-8}} and {{Vary}} on
> static files, a {{Date}} header on error responses, and the default acceptor
> count.
> h3. Done when
> * No Jetty 9.4 artifact is left on any module classpath of the trunk build.
> * Every daemon serves on Jetty 12, and the full test suite passes.
> * The release note of HADOOP-19972 lists every incompatible change.
> h3. Out of scope
> * The jakarta namespace, Jetty ee10/ee11, Jersey 3 and JAXB 4: HADOOP-19395.
> * Jetty 9.4 security updates on release lines that cannot move to Java 17:
> HADOOP-19915.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
